CVE-2026-5301

CVE-2026-5301 is a stored cross-site scripting (XSS) vulnerability in CoolerControl's log viewer component affecting versions prior to 4.0.0. The flaw enables unauthenticated attackers to inject malicious JavaScript code into log entries, which is then executed when the logs are viewed. This vulnerability permits complete service compromise through stored XSS payloads that persist in log data. The attack has a CVSS score of 6.1 (Medium severity) with a network-based attack vector requiring no authentication or special privileges, though user interaction is necessary to trigger the payload. The vulnerability could result in limited confidentiality and integrity impacts with the ability to affect systems beyond the immediate application boundary. The EPSS score of 0.00028 indicates minimal observed exploitation prevalence in the wild. This vulnerability is not currently listed on the Known Exploited Vulnerabilities (KEV) catalog and is marked as inactive on industry hot lists, suggesting no active exploitation campaigns are documented at this time. While the FAUCET risk score of 43.0/100 suggests moderate concern, the low EPSS prevalence indicates limited real-world exploitation activity or publicly available exploit code. Organizations running CoolerControl versions below 4.0.0 should prioritize patching to address the unauthenticated XSS vector.